CVE-2026-58486: HedgeDoc YAML Alias Bomb DoS Vulnerability

CVE-2026-58486 Overview

CVE-2026-58486 is a denial-of-service (DoS) vulnerability in HedgeDoc, an open source real-time collaborative markdown notes application. Versions prior to 1.11.0 parse note frontmatter using js-yaml.load (js-yaml v3) via @hedgedoc/meta-marked, which resolves YAML anchor aliases. A compact malicious payload can expand into a large object structure, saturating CPU on every request to the publish view (/s/<shortid>) or the editor view (/<noteId>) when placed under the opengraph key. The vulnerability is tracked under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
A ten-level alias bomb can block the Node.js event loop for roughly 235 seconds per request, causing concurrent requests to hang or drop and rendering the instance unavailable. The malicious note persists in the database, so the impact survives process restarts until the note is removed.

Affected Products

HedgeDoc versions prior to 1.11.0
Deployments using @hedgedoc/meta-marked for frontmatter parsing
Instances relying on toobusy-js for event loop protection (does not reliably mitigate this attack)

Discovery Timeline

2026-07-13 - CVE-2026-58486 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-58486

Vulnerability Analysis

HedgeDoc processes YAML frontmatter in notes through js-yaml version 3, which resolves anchor aliases during parsing. An attacker can craft a small YAML document that references the same anchor repeatedly across multiple nesting levels. Each level multiplies the expansion factor, producing an object structure orders of magnitude larger than the input payload.

Because parsing runs synchronously on the single Node.js event loop, expansion of a ten-level alias bomb blocks execution for approximately 235 seconds. During this period, all other HTTP requests to the instance queue or time out. The toobusy-js middleware cannot respond in time because the event loop is already saturated before it can evaluate load.

The stored nature of the payload amplifies impact. Once the malicious note is written to the database, every subsequent request to the publish or editor route re-triggers the expansion, sustaining the denial of service across process restarts.

Root Cause

The root cause is unsafe YAML parsing without structural constraints. The metaMarked library invokes js-yaml.load, which resolves aliases without limiting depth, breadth, or total node count. No downstream validation constrained the resulting object before it entered request handlers.

Attack Vector

An authenticated user with permission to create or edit a note submits YAML frontmatter containing recursively expanding anchor aliases. The payload triggers on any request to the publish view (/s/<shortid>). When the payload is placed under the opengraph key, it also triggers on the editor view (/<noteId>), broadening the attack surface.

javascript

// Security patch in public/js/extra.js
// refactor(frontmatter): constrain frontmatter object after parsing
  if (line >= end) return false

  try {
-    md.meta = window.jsyaml.safeLoad(data.join('\n')) || {}
+    const parsed = window.jsyaml.load(data.join('\n')) || {}
+    md.meta = window.ConstrainObject.constrainObject(parsed, {
+      onCycle: 'omit',
+      maxDepth: 4
+    })
    delete md.metaError
  } catch (err) {
    md.metaError = err

Source: HedgeDoc commit c489497

The patch introduces constrainObject to cap depth at 4 levels and omit cyclic references after parsing completes.

Detection Methods for CVE-2026-58486

Indicators of Compromise

Notes containing YAML frontmatter with repeated anchor definitions (&anchor) and alias references (*anchor) nested across multiple levels
HTTP requests to /s/<shortid> or /<noteId> endpoints that exceed normal response latency by orders of magnitude
Node.js process CPU pinned at 100% on a single core for extended periods

Detection Strategies

Inspect stored notes for YAML frontmatter containing anchor and alias syntax with nesting depth greater than 3
Monitor event loop lag metrics on HedgeDoc processes for sustained values above normal baselines
Correlate spikes in request duration on publish and editor routes with specific note identifiers to isolate malicious content

Monitoring Recommendations

Enable application performance monitoring on Node.js event loop delay and per-route latency
Log all note creation and edit events with authenticated user identity for post-incident attribution
Alert on repeated timeouts targeting the same shortid or noteId path

How to Mitigate CVE-2026-58486

Immediate Actions Required

Upgrade HedgeDoc to version 1.11.0 or later
Audit existing notes in the database for suspicious YAML frontmatter using anchor and alias constructs
Delete any notes identified as containing alias bomb payloads to restore instance availability

Patch Information

The fix is available in HedgeDoc 1.11.0. The patch replaces @hedgedoc/meta-marked with a direct js-yaml call and applies constrainObject to bound the parsed structure. Refer to the GitHub Security Advisory GHSA-qj78-mjch-wwrv and commit c489497 for implementation details.

Workarounds

Restrict note creation and edit permissions to trusted users until the patch is applied
Place HedgeDoc behind a reverse proxy that enforces request body size limits and per-client rate limits
Remove any offending notes directly from the database if the instance becomes unresponsive

bash

# Upgrade HedgeDoc via Docker
docker pull quay.io/hedgedoc/hedgedoc:1.11.0
docker stop hedgedoc && docker rm hedgedoc
docker run -d --name hedgedoc \
  -p 3000:3000 \
  -e CMD_DB_URL="$DB_URL" \
  quay.io/hedgedoc/hedgedoc:1.11.0